CVE-2026-93494

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A flaw in the StompSubframeDecoder component allows a remote attacker to cause a permanent memory leak by sending a specially crafted STOMP frame body that lacks its terminating null byte. This action forces the decoder to allocate a ByteBuf (a buffer used to hold bytes) that is never released. Continuous exploitation of this issue can lead to uncontrolled memory consumption, resulting in a Denial of Service (DoS) for applications utilizing the affected STOMP codec.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.